Easter Eggs – hidden ingredients in software and cake

Posted byAnnePosted inApplication security, secure development, Uncategorized, VulnerabilitiesTags:, , ,

What would Easter be without Easter Eggs and the taste of chocolate? Software, on the other hand, does not need Easter Eggs. Probably, there will be a few undocumented features accidentally anyway, without anyone implementing those on purpose. What about cake, then? Do you prefer your cake with or without easter eggs?

Easter Eggs are hidden features in applications

Easter Eggs are hidden features, messages, or videos in software, video games, movies, or another electronic medium. In this blog post, I will focus on Easter Eggs in software. Easter Eggs in applications can manifest as surprising responses to secret commands or even games concealed inside a utility tool: for example, Microsoft Excel 95 contained an action game called Hall of Tortured Souls.

Are easter eggs good or bad?

I got to admit that Easter Eggs in software can be fun. Doing a Google search for askew and getting a slightly tilted list of search results is surprising and pretty cool. But what about an action game inside Excel? No wonder why the Office package required so much disk space! Bloating software with unnecessary additions does not sound too professional, either. Luckily, I think the only way to buy Excel 95 was on CDs, so you didn’t have to download the thing with painlessly slow modem speeds.

And importantly, if a feature is unknown and undocumented, probably it’s untested. Therefore, you cannot know if an Easter Egg contains bugs or vulnerabilities. When found, these vulnerabilities could have unfortunate consequences.

A light yellow cheesecake on a plate. The cake is decorated with small colourful egg-shaped candies.
Are Easter Eggs good or bad? In the case of this cheesecake, I think they were pretty tasty. In software, on the other hand, Easter Eggs are controversial, since unknown features could contain vulnerabilities that we don’t know about.

There are a few very authoritative sources against Easter Eggs in code. 

First, Microsoft’s Trustworthy Computing Initiative reasons you should be able to trust what is on your computer, meaning that there is nothing unplanned. Having an undocumented feature does not contribute to that trust. In this blog article, Larry Osterman mentions that Easter Eggs can have security vulnerabilities.

Secondly, the OWASP Application Security Verification Standard (ASVS), the go-to place for web application security requirements, gives a no-go to Easter Eggs. In the ASVS section dedicated to malicious code, ASVS control 10.2.6 requires you to “Verify that the application source code and third party libraries do not contain Easter eggs or any other potentially unwanted functionality”. 

Easter egg cake

The easter eggs in this cake are not hidden but a part of the decoration on top. The apricot cheesecake recipe is from a Finnish household magazine, and I think the recipe was only published in the printed version. In my opinion, this cake also works with mango instead of apricot.

A round cheesecake on a plate is placed on a table that has plates and glasses set. The cheesecake has a thick, light yellow filling and it's decorated with small yellow, white, green and pink candies that look like miniature bird eggs.

Cookie crumb crust:

  • 200 g caramelized sugar cookies (Bastogne cookies)
  • 100 g dark chocolate

Filling

  • 6 gelatine leaves
  • 2 dl whipping cream
  • 200 g orange flavor cream cheese 
  • 250 g quark
  • 2 cans (á 410/230 g) canned apricot
  • 2 tbsp apricot juice (from the can)
  • 2 dl sugar
  • 2 tsp vanilla sugar
  • 1 tsp ginger powder
  • 0,25 tsp salt
  • Miniature chocolate eggs and egg-shaped candies for decoration

Line a springform pan (diameter around 20-28 cm) with baking paper. Butter the edges of the pan. 

Crush the cookies into fine crumbs with a food processor, or put the cookies into a plastic bag and roll over the cookies with a rolling pin. 

Cut the chocolate into small pieces and melt it in a microwave oven or over hot water. Pour the melted chocolate over the cookie crumbs and mix well. Press the crust into the pan. 

Soak gelatine leaves in a bowl of cold water for 5 minutes. 

Meanwhile, whip the cream and mix it with cream cheese and quark. 

Take 2 tbsp of apricot juice from the can and put it into a small pot. 

Drain the excess juice and mash the apricots with a blender or a food processor. Mix the apricot mash with the sugar, vanilla sugar, ginger powder, and whipped cream.

Heat the apricot juice in the pot. Squeeze the gelatine leaves as dry as possible and let them dissolve in the hot liquid. Pour the juice into the rest of the filling and make sure to mix it thoroughly. 

Spread the filling on top of the crust in the springform pan. Use a spatula to smooth the top.

Refrigerate the cake for at least 6 hours or overnight. Remove the sides of the springform pan carefully. Decorate the cake with miniature chocolate eggs and egg-shaped candies. 

Enjoy!